@prefix : . @prefix owl: . @prefix rdf: . @prefix xml: . @prefix xsd: . @prefix rdfs: . @base . rdf:type owl:Ontology ; owl:versionIRI ; owl:imports ; "Annika Moscati" , "Bincy Veena" , "Peter Johansson" ; "2026-04-01"^^xsd:date ; "Rahel Kebede" ; """A modular semantic framework for role-, attribute-, relationship-, and purpose-based access control over Digital Product Passport data, aligned with ESPR, GDPR, and ODRL 2.2."""@en ; ; "DPP Access Control Ontology Module"@en ; owl:versionInfo "1.0.0" . ################################################################# # Annotation properties ################################################################# ### http://purl.org/dc/terms/contributor rdf:type owl:AnnotationProperty . ### http://purl.org/dc/terms/created rdf:type owl:AnnotationProperty . ### http://purl.org/dc/terms/creator rdf:type owl:AnnotationProperty . ### http://purl.org/dc/terms/description rdf:type owl:AnnotationProperty . ### http://purl.org/dc/terms/license rdf:type owl:AnnotationProperty . ### http://purl.org/dc/terms/title rdf:type owl:AnnotationProperty . ### http://www.w3.org/2004/02/skos/core#definition rdf:type owl:AnnotationProperty . ### http://www.w3.org/2004/02/skos/core#prefLabel rdf:type owl:AnnotationProperty . ### http://www.w3.org/2004/02/skos/core#scopeNote rdf:type owl:AnnotationProperty . ################################################################# # Datatypes ################################################################# ### http://www.w3.org/2001/XMLSchema#date xsd:date rdf:type rdfs:Datatype . ################################################################# # Object Properties ################################################################# ### http://w3id.org/dpp/access-control#appliedPolicy :appliedPolicy rdf:type owl:ObjectProperty ; rdfs:domain :AccessDecision ; rdfs:range :AccessPolicy ; """The AccessPolicy (or policies) that were evaluated to produce this decision."""@en ; "applied policy"@en . ### http://w3id.org/dpp/access-control#appliesToRole :appliesToRole rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain :AccessPolicy ; rdfs:range :Role ; "The Role to which this AccessPolicy is addressed."@en ; "applies to role"@en . ### http://w3id.org/dpp/access-control#belongsToModule :belongsToModule rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain :DPPResource ; rdfs:range ; "The ESPR-defined data category (DPP module) that contains this resource."@en ; "belongs to module"@en . ### http://w3id.org/dpp/access-control#decidesOn :decidesOn rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain :AccessDecision ; rdfs:range :AccessRequest ; "Links this AccessDecision to the AccessRequest it resolves."@en ; "decides on"@en . ### http://w3id.org/dpp/access-control#delegatedBy :delegatedBy rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain :Delegation ; rdfs:range :Principal ; "The Principal who grants delegated access rights."@en ; "delegated by"@en . ### http://w3id.org/dpp/access-control#delegatedTo :delegatedTo rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain :Delegation ; rdfs:range :Principal ; "The Principal who receives delegated access rights."@en ; "delegated to"@en . ### http://w3id.org/dpp/access-control#delegationCoversAction :delegationCoversAction rdf:type owl:ObjectProperty ; rdfs:domain :Delegation ; rdfs:range ; "The action(s) the delegatee is authorised to perform."@en ; "delegation covers action"@en . ### http://w3id.org/dpp/access-control#delegationCoversResource :delegationCoversResource rdf:type owl:ObjectProperty ; rdfs:domain :Delegation ; rdfs:range :DPPResource ; "The DPP resource(s) over which delegated rights are granted."@en ; "delegation covers resource"@en . ### http://w3id.org/dpp/access-control#hasAttributeConstraint :hasAttributeConstraint rdf:type owl:ObjectProperty ; rdfs:domain :AccessPolicy ; rdfs:range :AttributeConstraint ; """Links an AccessPolicy to one or more AttributeConstraints that must all be satisfied for the policy's permissions to activate."""@en ; "has attribute constraint"@en . ### http://w3id.org/dpp/access-control#hasRole :hasRole rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain :Principal ; rdfs:range :Role ; "Assigns a single Access Control Role to a Principal."@en ; "has role"@en . ### http://w3id.org/dpp/access-control#ownedBy :ownedBy rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain :DPPResource ; rdfs:range :Principal ; """The Principal who is the authoritative data owner of this DPP resource and may grant or revoke access."""@en ; "owned by"@en . ### http://w3id.org/dpp/access-control#policyOwner :policyOwner rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain :AccessPolicy ; rdfs:range :Principal ; "The Principal responsible for the lifecycle of this policy."@en ; "policy owner"@en . ### http://w3id.org/dpp/access-control#requestContext :requestContext rdf:type owl:ObjectProperty ; rdfs:domain :AccessRequest ; rdfs:range :AccessContext ; """Environmental or situational metadata that conditions the evaluation of this access request."""@en ; "request context"@en . ### http://w3id.org/dpp/access-control#requestedAction :requestedAction rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain :AccessRequest ; rdfs:range ; "The CRUD action the Principal intends to perform."@en ; "requested action"@en . ### http://w3id.org/dpp/access-control#requestedBy :requestedBy rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain :AccessRequest ; rdfs:range :Principal ; "Links an AccessRequest to the Principal who submitted it."@en ; "requested by"@en . ### http://w3id.org/dpp/access-control#requestedResource :requestedResource rdf:type owl:ObjectProperty , owl:FunctionalProperty ; rdfs:domain :AccessRequest ; rdfs:range :DPPResource ; "The DPP resource the Principal intends to access."@en ; "requested resource"@en . ################################################################# # Data properties ################################################################# ### http://w3id.org/dpp/access-control#accessValidFrom :accessValidFrom rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :TemporalContext ; rdfs:range xsd:dateTime ; "The UTC date-time from which this temporal access window opens."@en ; "access valid from"@en . ### http://w3id.org/dpp/access-control#accessValidUntil :accessValidUntil rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :TemporalContext ; rdfs:range xsd:dateTime ; "The UTC date-time at which this temporal access window closes."@en ; "access valid until"@en . ### http://w3id.org/dpp/access-control#certificationIsValid :certificationIsValid rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :CertificationContext ; rdfs:range xsd:boolean ; "True if the referenced certification is currently valid and in good standing."@en ; "certification is valid"@en . ### http://w3id.org/dpp/access-control#certificationScheme :certificationScheme rdf:type owl:DatatypeProperty ; rdfs:domain :CertificationContext ; rdfs:range xsd:string ; "The name or identifier of the certification scheme."@en ; "certification scheme"@en . ### http://w3id.org/dpp/access-control#conflictResolutionApplied :conflictResolutionApplied rdf:type owl:DatatypeProperty ; rdfs:domain :AccessDecision ; rdfs:range xsd:boolean ; """True if a deny-overrides conflict resolution strategy was invoked during this decision evaluation."""@en ; "conflict resolution applied"@en . ### http://w3id.org/dpp/access-control#constraintAttribute :constraintAttribute rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :AttributeConstraint ; rdfs:range xsd:string ; "The name of the attribute being constrained."@en ; "constraint attribute"@en ; "E.g., trustAssuranceLevel, resourceSensitivity, certificationIsValid."@en . ### http://w3id.org/dpp/access-control#constraintOperator :constraintOperator rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :AttributeConstraint ; rdfs:range xsd:string ; "The comparison operator applied to the attribute value."@en ; "constraint operator"@en ; "Allowed values: EQ, NEQ, GT, LT, GTE, LTE, IN."@en . ### http://w3id.org/dpp/access-control#constraintValue :constraintValue rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :AttributeConstraint ; rdfs:range xsd:string ; "The value against which the attribute is compared."@en ; "constraint value"@en . ### http://w3id.org/dpp/access-control#decisionOutcome :decisionOutcome rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :AccessDecision ; rdfs:range xsd:string ; "The result of evaluating the access request."@en ; "decision outcome"@en ; "Allowed values: GRANT, DENY, DELEGATE, PENDING."@en . ### http://w3id.org/dpp/access-control#decisionTimestamp :decisionTimestamp rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :AccessDecision ; rdfs:range xsd:dateTime ; "The UTC date-time at which the access decision was recorded."@en ; "decision timestamp"@en . ### http://w3id.org/dpp/access-control#declaredPurpose :declaredPurpose rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :PurposeContext ; rdfs:range xsd:string ; "A textual description of the purpose for which data access is requested."@en ; "declared purpose"@en . ### http://w3id.org/dpp/access-control#delegationDepth :delegationDepth rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :Delegation ; rdfs:range xsd:integer ; "The number of sub-delegation hops permitted from this delegation."@en ; "delegation depth"@en ; "Maximum allowed value is 1. Sub-delegation is prohibited by policy."@en . ### http://w3id.org/dpp/access-control#delegationIsActive :delegationIsActive rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :Delegation ; rdfs:range xsd:boolean ; """True if this delegation is currently within its valid time window and has not been revoked."""@en ; "delegation is active"@en . ### http://w3id.org/dpp/access-control#delegationValidFrom :delegationValidFrom rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :Delegation ; rdfs:range xsd:dateTime ; "The UTC date-time from which the delegation is active."@en ; "delegation valid from"@en . ### http://w3id.org/dpp/access-control#delegationValidUntil :delegationValidUntil rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :Delegation ; rdfs:range xsd:dateTime ; "The UTC date-time at which the delegation expires."@en ; "delegation valid until"@en . ### http://w3id.org/dpp/access-control#jurisdictionCode :jurisdictionCode rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :GeographicContext ; rdfs:range xsd:string ; "The jurisdiction in which this access constraint applies."@en ; "jurisdiction code"@en ; "ISO 3166-1 alpha-2 country code, or the literals EU or EEA."@en . ### http://w3id.org/dpp/access-control#permittedPurpose :permittedPurpose rdf:type owl:DatatypeProperty ; rdfs:domain :AccessPolicy ; rdfs:range xsd:string ; """A purpose code that an access request must declare to activate this policy's permissions."""@en ; "permitted purpose"@en ; """Must be one of the purpose codes defined in PurposeContextShape: MAINTENANCE, COMPLIANCE_AUDIT, RECYCLING_PROCESSING, MARKET_SURVEILLANCE, CUSTOMS_INSPECTION, CONSUMER_INFORMATION, RESEARCH_DEVELOPMENT, SUPPLY_CHAIN_DUE_DILIGENCE."""@en . ### http://w3id.org/dpp/access-control#policyValidFrom :policyValidFrom rdf:type owl:DatatypeProperty ; rdfs:domain :AccessPolicy ; rdfs:range xsd:dateTime ; "The UTC date-time from which this policy is active."@en ; "policy valid from"@en . ### http://w3id.org/dpp/access-control#policyValidUntil :policyValidUntil rdf:type owl:DatatypeProperty ; rdfs:domain :AccessPolicy ; rdfs:range xsd:dateTime ; "The UTC date-time after which this policy expires."@en ; "policy valid until"@en . ### http://w3id.org/dpp/access-control#requestTimestamp :requestTimestamp rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :AccessRequest ; rdfs:range xsd:dateTime ; "The UTC date-time at which the AccessRequest was submitted."@en ; "request timestamp"@en . ### http://w3id.org/dpp/access-control#resourceSensitivity :resourceSensitivity rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :DPPResource ; rdfs:range xsd:string ; "Classification of the sensitivity level of this DPP resource."@en ; "resource sensitivity"@en ; """Allowed values: PUBLIC, RESTRICTED, CONFIDENTIAL, STRICTLY_CONFIDENTIAL."""@en . ### http://w3id.org/dpp/access-control#trustAssuranceLevel :trustAssuranceLevel rdf:type owl:DatatypeProperty , owl:FunctionalProperty ; rdfs:domain :TrustContext ; rdfs:range xsd:string ; "The eIDAS assurance level of the requester's authentication."@en ; "trust assurance level"@en ; "eIDAS values: LOW, SUBSTANTIAL, HIGH."@en . ################################################################# # Classes ################################################################# ### http://w3id.org/dpp/access-control#AccessContext :AccessContext rdf:type owl:Class ; """Environmental, temporal, geographic, or purpose-related metadata that conditions the evaluation of an access request."""@en ; "Access Context"@en . ### http://w3id.org/dpp/access-control#AccessDecision :AccessDecision rdf:type owl:Class ; rdfs:subClassOf ; """An immutable, time-stamped record of the outcome of evaluating an AccessRequest against applicable AccessPolicies."""@en ; "Access Decision"@en . ### http://w3id.org/dpp/access-control#AccessPolicy :AccessPolicy rdf:type owl:Class ; rdfs:subClassOf ; """A declarative specification of permissions and prohibitions over DPP resources, scoped to a Role and optionally conditioned on contextual constraints."""@en ; "DPP Access Policy"@en . ### http://w3id.org/dpp/access-control#AccessRequest :AccessRequest rdf:type owl:Class ; rdfs:subClassOf ; """A formal, time-stamped expression of intent by a Principal to perform a specific Action on a specific DPP resource."""@en ; "Access Request"@en . ### http://w3id.org/dpp/access-control#AttributeConstraint :AttributeConstraint rdf:type owl:Class ; """A condition on a named attribute of the requesting Principal or target resource that must be satisfied for a policy's permissions to apply."""@en ; "Attribute Constraint"@en . ### http://w3id.org/dpp/access-control#CertificationContext :CertificationContext rdf:type owl:Class ; rdfs:subClassOf :AccessContext ; """Evidence of a certification held by the requesting Principal that may unlock access to restricted DPP data."""@en ; "Certification Context"@en . ### http://w3id.org/dpp/access-control#DPPResource :DPPResource rdf:type owl:Class ; rdfs:subClassOf , ; """A discrete, addressable unit of data within a Digital Product Passport that may be the target of an access request."""@en ; "DPP Resource"@en . ### http://w3id.org/dpp/access-control#Delegation :Delegation rdf:type owl:Class ; rdfs:subClassOf ; """A bounded, time-limited transfer of a subset of access rights from one Principal to another."""@en ; "Delegation"@en . ### http://w3id.org/dpp/access-control#GeographicContext :GeographicContext rdf:type owl:Class ; rdfs:subClassOf :AccessContext ; "A jurisdictional constraint on where access may be exercised."@en ; "Geographic Context"@en . ### http://w3id.org/dpp/access-control#HumanPrincipal :HumanPrincipal rdf:type owl:Class ; rdfs:subClassOf :Principal ; "A natural person acting as a DPP data requester or owner."@en ; "Human Principal"@en . ### http://w3id.org/dpp/access-control#OrganisationPrincipal :OrganisationPrincipal rdf:type owl:Class ; rdfs:subClassOf :Principal ; "A legal entity or organisation acting as a DPP stakeholder."@en ; "Organisation Principal"@en . ### http://w3id.org/dpp/access-control#Principal :Principal rdf:type owl:Class ; rdfs:subClassOf , ; """Any entity — human, organisation, or automated system — that may request access to DPP resources."""@en ; "Principal"@en . ### http://w3id.org/dpp/access-control#PurposeContext :PurposeContext rdf:type owl:Class ; rdfs:subClassOf :AccessContext , ; """The declared purpose for which a Principal requests access, per GDPR Article 5(1)(b) purpose limitation."""@en ; "Purpose Context"@en . ### http://w3id.org/dpp/access-control#Role :Role rdf:type owl:Class ; """A named function or responsibility assigned to a Principal that determines which access policies apply."""@en ; "Access Control Role"@en . ### http://w3id.org/dpp/access-control#SystemPrincipal :SystemPrincipal rdf:type owl:Class ; rdfs:subClassOf :Principal ; """An automated agent or software system acting as a DPP data consumer or producer."""@en ; "System Principal"@en . ### http://w3id.org/dpp/access-control#TemporalContext :TemporalContext rdf:type owl:Class ; rdfs:subClassOf :AccessContext ; "A time window within which access is permitted."@en ; "Temporal Context"@en . ### http://w3id.org/dpp/access-control#TrustContext :TrustContext rdf:type owl:Class ; rdfs:subClassOf :AccessContext ; """The assurance level of the authentication mechanism used by the requesting Principal."""@en ; "Trust Context"@en . ### http://w3id.org/dpp/data-categories#DataCategory rdf:type owl:Class . ### http://www.w3.org/ns/odrl/2/Action rdf:type owl:Class . ### http://www.w3.org/ns/odrl/2/Asset rdf:type owl:Class . ### http://www.w3.org/ns/odrl/2/Party rdf:type owl:Class . ### http://www.w3.org/ns/odrl/2/Policy rdf:type owl:Class . ### http://www.w3.org/ns/prov#Activity rdf:type owl:Class . ### http://www.w3.org/ns/prov#Agent rdf:type owl:Class . ### http://www.w3.org/ns/prov#Entity rdf:type owl:Class . ### https://w3id.org/dpv#Purpose rdf:type owl:Class . ################################################################# # Individuals ################################################################# ### http://w3id.org/dpp/access-control#CreateResource :CreateResource rdf:type owl:NamedIndividual , ; """Introduce a new data record into a DPP module where no prior record exists for that resource identifier."""@en ; "Create"@en . ### http://w3id.org/dpp/access-control#DelegateAccess :DelegateAccess rdf:type owl:NamedIndividual , ; """Transfer a subset of one's own access rights to another Principal for a bounded scope and time period."""@en ; "Delegate"@en . ### http://w3id.org/dpp/access-control#DeleteResource :DeleteResource rdf:type owl:NamedIndividual , ; """Remove a DPP resource record, subject to data retention obligations."""@en ; "Delete"@en . ### http://w3id.org/dpp/access-control#ReadResource :ReadResource rdf:type owl:NamedIndividual , ; """Retrieve and inspect the content of a DPP resource without modifying it."""@en ; "Read"@en . ### http://w3id.org/dpp/access-control#UpdateResource :UpdateResource rdf:type owl:NamedIndividual , ; "Modify the content of an existing DPP resource record."@en ; "Update"@en . ### Generated by the OWL API (version 5.1.18) https://github.com/owlcs/owlapi/